def remove_pointers_from_folder(**kwargs):
    """Remove multiple pointers from a node, raising a 400 if the pointer is not
    in `node.nodes`.
    """
    auth = kwargs['auth']
    node = kwargs['node'] or kwargs['project']
    pointer_ids = request.json.get('pointerIds')

    if pointer_ids is None:
        raise HTTPError(http.BAD_REQUEST)

    for pointer_id in pointer_ids:
        pointer_id = node.pointing_at(pointer_id)

        pointer = Pointer.load(pointer_id)

        if pointer is None:
            raise HTTPError(http.BAD_REQUEST)

        try:
            node.rm_pointer(pointer, auth=auth)
        except ValueError:
            raise HTTPError(http.BAD_REQUEST)

    node.save()

def migrate(dry=True):
    migrated = 0
    pointers_with_invalid_backrefs = []
    pointers = database.pointer.find({'$where': 'this._id.length <= 5'}, {'_id': True})
    total = pointers.count()
    for i, doc in enumerate(pointers):
        pointer = Pointer.load(doc['_id'])
        with TokuTransaction():
            old_id = pointer._id
            logger.info('({}/{}) Preparing to migrate Pointer {}'.format(i + 1, total, old_id))
            pointer._legacy_id = old_id
            pointer._id = str(ObjectId())
            try:
                if not dry:
                    pointer.save()
            except ValueError:
                logger.warn('Removing backref for orphaned pointer: {}'.format(old_id))
                if not dry:
                    remove_invalid_backref(pointer)
                    pointers_with_invalid_backrefs.append(old_id)
                    pointer.save()
            logger.info('Successfully migrated Pointer {} _id to {}'.format(old_id, pointer._id))
            migrated += 1
    logger.info('Successfully migrated {} pointers'.format(migrated))
    logger.info('Removed invalid backrefs on {} pointers: {}'.format(len(pointers_with_invalid_backrefs), pointers_with_invalid_backrefs))

 def has_object_permission(self, request, view, obj):
     assert isinstance(obj, (Node, Pointer)), 'obj must be a Node or Pointer, got {}'.format(obj)
     auth = get_user_auth(request)
     parent_node = Node.load(request.parser_context['kwargs']['node_id'])
     pointer_node = Pointer.load(request.parser_context['kwargs']['node_link_id']).node
     if request.method in permissions.SAFE_METHODS:
         has_parent_auth = parent_node.can_view(auth)
         has_pointer_auth = pointer_node.can_view(auth)
         public = obj.is_public
         has_auth = public or (has_parent_auth and has_pointer_auth)
         return has_auth
     else:
         has_auth = parent_node.can_edit(auth)
         return has_auth

def fork_pointer(auth, node, **kwargs):
    """Fork a pointer. Raises BAD_REQUEST if pointer not provided, not found,
    or not present in `nodes`.

    """
    pointer_id = request.json.get('pointerId')
    pointer = Pointer.load(pointer_id)

    if pointer is None:
        # TODO: Change this to 404?
        raise HTTPError(http.BAD_REQUEST)

    try:
        node.fork_pointer(pointer, auth=auth, save=True)
    except ValueError:
        raise HTTPError(http.BAD_REQUEST)

def remove_pointer_from_folder(auth, node, pointer_id, **kwargs):
    """Remove a pointer from a node, raising a 400 if the pointer is not
    in `node.nodes`.

    """
    if pointer_id is None:
        raise HTTPError(http.BAD_REQUEST)

    pointer_id = node.pointing_at(pointer_id)

    pointer = Pointer.load(pointer_id)

    if pointer is None:
        raise HTTPError(http.BAD_REQUEST)

    try:
        node.rm_pointer(pointer, auth=auth)
    except ValueError:
        raise HTTPError(http.BAD_REQUEST)

    node.save()

def remove_pointer(auth, node, **kwargs):
    """Remove a pointer from a node, raising a 400 if the pointer is not
    in `node.nodes`.

    """
    # TODO: since these a delete request, shouldn't use request body. put pointer
    # id in the URL instead
    pointer_id = request.json.get('pointerId')
    if pointer_id is None:
        raise HTTPError(http.BAD_REQUEST)

    pointer = Pointer.load(pointer_id)
    if pointer is None:
        raise HTTPError(http.BAD_REQUEST)

    try:
        node.rm_pointer(pointer, auth=auth)
    except ValueError:
        raise HTTPError(http.BAD_REQUEST)

    node.save()

def move_pointers(auth):
    """Move pointer from one node to another node.

    """

    from_node_id = request.json.get('fromNodeId')
    to_node_id = request.json.get('toNodeId')
    pointers_to_move = request.json.get('pointerIds')

    if from_node_id is None or to_node_id is None or pointers_to_move is None:
        raise HTTPError(http.BAD_REQUEST)

    from_node = Node.load(from_node_id)
    to_node = Node.load(to_node_id)

    if to_node is None or from_node is None:
        raise HTTPError(http.BAD_REQUEST)

    for pointer_to_move in pointers_to_move:
        pointer_id = from_node.pointing_at(pointer_to_move)
        pointer_node = Node.load(pointer_to_move)

        pointer = Pointer.load(pointer_id)
        if pointer is None:
            raise HTTPError(http.BAD_REQUEST)

        try:
            from_node.rm_pointer(pointer, auth=auth)
        except ValueError:
            raise HTTPError(http.BAD_REQUEST)

        from_node.save()
        try:
            _add_pointers(to_node, [pointer_node], auth)
        except ValueError:
            raise HTTPError(http.BAD_REQUEST)

    return {}, 200, None